Tim McCormack says words
Some quick notes on setting up a shared folder between a host computer and a virtual machine, using Debian 13 for both host and guest. This is great if you're working with untrusted files and want a safe place to work with them. (Another option is something like magic-wormhole , if network access is permitted.) The only really unintuitive thing is the virtiofs "target". I thought this was supposed…
I don't have a smartphone, so I run Signal Desktop on my laptop. Signal does not really want you to do this, and you have to run some unofficial third-party stuff for this to all work. Yes, that's a little sketchy, especially for a secure communications tool, but this is where Signal leaves us when they refuse to give us first-class desktop support. Here, I document what I've had to do to get this…
A few years ago I decided to get a routine skin checkup (you know, check out all my weird bumps and spots to see if any of them are trying to kill me). My doctor recommended a nearby location, Mystic Valley Dermatology, which is apparently a branch of APDerm, some kind of regional dermatology network. Honestly, it was just the closest place. ...but today I'm recommending that you find a more…
After my fourth Bontrager bike headlight died too soon, I've made the switch to Fenix. While it's too early to have personal experience with the durability of Fenix, I'm really happy with the switch, and I wish I had done it sooner—it's clear that Fenix stands behind their products in a way that Bontrager/Trek does not. Bontrager problems My first Bontrager headlight was a gift, so I don't have a…
Yesterday I installed updates on my Ubuntu 24.04 work laptop and rebooted, and was annoyed to find that I was being logged into the Unity desktop, not XFCE. Not only that, but after logging out again I discovered that there wasn't even an option for selecting XFCE. The login screen also looked different. The solution seemed to be to select a different greeter. More details under the cut. I think…
Over this winter break I've had some more time to work on Cavern , the social journaling protocol I've been developing intermittently for a few years now. If you're not familiar with it, it takes some inspiration from blogs, feed readers, dead-drops, IPFS, Dreamwidth, and self-hosting sensibilities. It's pretty quixotic but I think it could meet the needs of a bunch of people. I don't get as much…
Inspired by Foone's suggestion this week I decided to start serving poisoned versions of my blog posts to any AI scrapers that I could identify—because I don't think it's enough to politely ask them to stop with a robots.txt file. They've already scraped my posts without asking; it's too late to undo that. But maybe I can hurt them just a little bit, going forward. This post is about the technical…
We have some slightly odd Easter traditions in my household. This year I made it a little weirder. I grew up with the usual American Easter egg hunt, where everyone would dye eggs and then on the night before Easter my parents would hide eggs around the house so that I could hunt for them in the morning. There was also a basket of candy somewhere. We were a little constrained in the hiding due to…
I received some Blink outdoor security cameras a while ago but haven't been able to make use of them because they require a smartphone and internet access to set up, and I don't have a smartphone and don't want these things streaming video of my comings and goings to Amazon. According to what I've read, I should be able to turn off cloud streaming and have the cameras instead stream to the sync…
I've been working from home for a few years now, and my happiest work environment is the front porch. It's in the breeze and (optionally) in the sun, but protected from light rain; I can hear birds and say hello to neighbors. The problem is that I have nothing even remotely resembling an ergonomic workstation: There's a chair, and the steps, and the floor. No desk. So I can't do it for very long…
With the current exodus from both Twitter and (to some degree) Reddit, there's a lot of discussion right now about what the replacements should look like. There's a rising wave of sentiment in my circles: Having corporations in control of the public square is terrible , in terms of both individual experience and the health of our societies. There's a lot of energy right now in designing systems…
I've seen any number of people defending ChatGPT's use as a tool that can not just write code, but find bugs in existing code. My own position is that it could be useful for this, but only in the hands of someone who is skeptical, detail-oriented, and experienced with the language. This is because ChatGPT doesn't know anything about programming; it just knows what code looks like and what people…
I've been using Firefox for something like 15 years, so it's no surprise that I eventually ended up with a corrupted profile (perhaps from a sudden shutdown). It was functional 99% of the time, but a few things would break in weird ways, like Local Storage getting cleared periodically for both web pages and extensions. It was subtle enough that by the time I noticed, it was too late to just…
The lxml toolkit is a library for working with XML and HTML from Python. It includes a utility called Cleaner that supports filtering HTML for dangerous and unwanted elements and attributes, although since early 2022 it has been marked as not suitable for security purposes . Nevertheless, it is still used that way by many projects. A coworker and I were recently exploring its capabilities. At one…
I seem to have accumulated some interesting links relating to agriculture, food systems, and general relationship to the land, and I haven't done a link roundup in ages... so today I'll be sharing with you: Landrace gardening A bank that supports local agriculture A blog about apples, agroforestry, pigs, and other topics The benefits of urine as fertilizer A caution on pawpaws Raising My Own…
As I discussed previously, parser mismatches are an underappreciated class of vulnerabilities. In that post I described what they are and showcased a few examples, but today I'd like to talk about what to do about them. I'll present a few options, with advice on when to use each technique. Today's example First, we'll need an example to use for all of the techniques. None of the real examples I…
Yesterday I got inspired to start playing around with Fourier transforms of images, and I'd like to share some of the results. Most are intended to just be artistic, although playing around has also given me a little more insight into how the frequency domain relates to to the spatial domain. There's also a git repo so that you can reproduce these images and video yourself, and for many of the…
There's a class of security vulnerabilities that has gotten very little attention until recently but shows up everywhere. In the past I called these dueling parser vulnerabilities, but recently there has been more recognition of this vulnerability class, and the terms parser confusion and parser mismatch have come into use. In this post I'll be using "parser mismatch" because it is the clearest…
This is a recipe for a 100% whole wheat sourdough with no extraneous ingredients: Just flour, water, salt, and starter. It does not require any kneading, and instead relies on a low-effort series of tensioning steps over the course of an evening, followed by an overnight proof rise. In the morning it is baked in a Dutch oven. By the numbers: Active work time is about 30 minutes including all prep…
I've seen a lot of uncertainty and misunderstandings about how to handle IP addresses correctly when developing and operating a web service: What's my user's IP address? How do I use the X-Forwarded-For header? What's the difference between that and X-Real-IP or other HTTP headers? This post explains the need for X-Forwarded-For (hereafter, "XFF"), provides a mental model for working with it, and…